Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A multinational enterprise structures its Google Cloud environment under an Organization node with top-level folders named Operations and Workloads. The Workloads folder contains two subfolders: Production and Development. The central security compliance team requires continuous visibility to inspect configuration metadata for all Google Cloud resources across the entire company. Meanwhile, an automated deployment system operating from a Virtual Machine in the Operations folder must provision Compute Engine instances and attach pre-existing workload service accounts exclusively within projects in the Development subfolder. You need to design an IAM access control architecture that enforces the principle of least privilege while minimizing operational overhead. Which IAM role assignment strategy should you implement?

  1. Grant Cloud Asset Viewer (roles/cloudasset.viewer) to the compliance team at the Organization node. Grant Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) and Service Account User (roles/iam.serviceAccountUser) to the deployment automation service account at the Development folder level.Answer
  2. B
    Grant the primitive Viewer role (roles/viewer) to the compliance team at the Organization node. Grant the primitive Editor role (roles/editor) to the deployment automation service account at the Workloads folder level.
  3. C
    Grant Cloud Asset Viewer (roles/cloudasset.viewer) to the compliance team at the Organization node. Grant Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) and Service Account Admin (roles/iam.serviceAccountAdmin) to the deployment automation service account at the Development folder level.
  4. D
    Grant Cloud Asset Viewer (roles/cloudasset.viewer) to the compliance team at the Organization node. Rely on folder-level IAM role restrictions to prevent automated workloads from exfiltrating data to external projects, while granting Compute Admin (roles/compute.admin) at the Operations folder level.

Answer

Grant Cloud Asset Viewer at the Organization level to the central compliance team, and grant Compute Instance Admin (v1) alongside Service Account User to the deployment automation service account bounded specifically at the Development folder level.
Assigning Cloud Asset Viewer at the Organization node provides complete resource metadata visibility across all descendant folders to meet audit requirements. Binding Compute Instance Admin (v1) and Service Account User directly on the Development folder enforces least privilege by restricting instance creation and service account attachment privileges strictly to the non-production workload environment.

Step-by-Step Solution

1
Analyze organization-wide auditing requirement
Identify that Cloud Asset Viewer (roles/cloudasset.viewer) assigned at the Organization node grants read-only access to asset metadata across all child folders and projects without exposing underlying resource payload data.
Auditing configuration metadata across an entire hierarchy requires organization-level scoping using specialized predefined roles.
2
Determine compute instance deployment and identity attachment permissions
Combine Compute Instance Admin (v1) for instance lifecycle management with Service Account User (roles/iam.serviceAccountUser) to bind pre-existing service accounts to VMs.
Creating a VM that runs as a specific service account requires both compute creation privileges and impersonation/usage rights over that identity.
3
Apply least privilege scope to the workload folder hierarchy
Bind the deployment permissions strictly to the Development subfolder node.
Inheritance flows down the resource tree. Placing the binding at the Development folder ensures no deployment capabilities leak into Production or Operations.

Key Concept

IAM Resource Hierarchy Inheritance and Fine-Grained Least Privilege Roles
Estimated Time:2m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy